{"id":6484,"date":"2022-05-10T16:31:39","date_gmt":"2022-05-10T15:31:39","guid":{"rendered":"https:\/\/www.bas.pt\/?p=6484"},"modified":"2025-08-26T18:23:57","modified_gmt":"2025-08-26T17:23:57","slug":"whistleblowing-alerts-for-companies-with-50-or-more-employees","status":"publish","type":"post","link":"https:\/\/www.bas.pt\/en\/communication\/legal-topics\/whistleblowing-alerts-for-companies-with-50-or-more-employees\/","title":{"rendered":"\u201cWhistleblowing\u201d alerts for companies with 50 or more employees"},"content":{"rendered":"

\u201cWhistleblowing\u201d alerts for companies with 50 or more employees<\/strong><\/h4>\n

Law No. 93\/2021 of 20 December, establishing the General Protection Regime for Whistleblowers (“RGPDI”) and transposing Directive (EU) 2019\/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law, is coming into force.<\/em><\/p>\n

Applicable to companies (public and private sector) with 50 or more employees and to entities that are within the scope of the European Union acts referred to in Directive (EU) 2019\/1937 of the European Parliament and of the Council. RGPDI establishes that covered entities must reflect in internal regulations a policy for reporting irregularities by 18 June 2022.<\/p>\n

Failure to comply with the RGPDI may result in the verification of a serious or very serious offense, with fines ranging from 500 to 250 thousand Euros, depending on whether the agent is an individual or a company and the type of offense.<\/p>\n

The new law considers a “Whistleblower” for protection purposes the natural person who, in good faith, with serious grounds to believe that the information is true on the date it is provided, reports or publicly discloses an infringement based on information obtained in the course of his or her professional activity.<\/p>\n

At issue are complaints regarding violations related to:<\/p>\n

i.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Public procurement;<\/p>\n

ii.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Financial services, products, and markets, and prevention of money laundering and terrorist financing;<\/p>\n

iii.\u00a0\u00a0\u00a0\u00a0\u00a0 Product security and compliance;<\/p>\n

iv.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Transport security;<\/p>\n

v.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Environmental protection;<\/p>\n

vi.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Radiation protection and nuclear safety;<\/p>\n

vii.\u00a0\u00a0\u00a0\u00a0\u00a0 Food and feed safety, animal health, and animal welfare;<\/p>\n

viii.\u00a0\u00a0\u00a0\u00a0 Public health;<\/p>\n

ix.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Consumer protection;<\/p>\n

x.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Privacy and personal data protection, and network and information systems security.<\/p>\n

Thus, and by reference to an internal complaint, external or public disclosure, the company must ensure the existence of proper channels to ensure secure communication, requiring that, when presented with a complaint, it must act independently, impartially, in terms of data protection, confidentiality, and absence of conflicts of interest.<\/p>\n

Internal reporting channels may be used internally for the purpose of receiving and following up on complaints by designated persons or services. They may, however, be operated externally for the purpose of receiving complaints.<\/p>\n

 <\/p>\n

Countdown to the entry into force of the General Protection Regime for Whistleblowers<\/strong><\/h4>\n

The RGPDI highlights the obligations with internal practical effects on legal persons. In particular, the company\u2019s obligations are:<\/p>\n

i. Ensure the existence of communication channels that allow the secure submission and follow-up of complaints, in order to guarantee the completeness, integrity, and preservation of the complaint, the confidentiality of the identity or anonymity of the complainants, and the confidentiality of the identity of third parties mentioned in the complaint, and to prevent access by unauthorized persons.<\/p>\n

ii. Record and retain complaints received for a minimum period of 5 years or, regardless of such period, during the pendency of judicial or administrative proceedings concerning the complaint;<\/p>\n

iii. Ensure confidentiality about the identity of the whistleblower;<\/p>\n

iv. Notify the complainant of the receipt of the complaint within 7 days and inform him\/her of the possibility and requirements for filing an external complaint, as well as the competent authorities to receive it;<\/p>\n

v. Inform the complainant of the requirements, the competent authorities, and the manner and admissibility of filing an external complaint.<\/p>\n

vi. Ensure that internal investigations last no longer than three months and that the actions taken are communicated to the whistleblower at the end of the internal investigation.<\/p>\n

vii. Provide the complainant, upon his\/her request, which may be made at any time, with the result of the analysis of the complaint within 15 days of its conclusion.<\/p>\n

viii. Prohibit and sanction the practice of retaliatory acts against the whistleblower.<\/p>\n

ix. Failure to comply with the requirements set out in the Law subjects the agents and companies in question to civil and administrative liability, without prejudice to any other consequences applicable to the specific case.<\/p>\n

 <\/p>\n

Depending on whether it is a very serious or serious offense, the following fines will be applied:<\/p>\n